Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!

Notices

Welcome to LinuxQuestions.org, a friendly and active Linux Community.

You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!

Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.

If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.

Having a problem logging in? Please visit this page to clear all LQ-related cookies.

Introduction to Linux - A Hands on Guide

This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.

One thing about that "net.ipv4.ip_forward=1" - it applies to routable IPv4 networks. The two networks you are using are members of "192.168.xx.xx" networks, and these are NOT routable.

You CAN use iptables to route these, but it is usually (not always) done as part of NAT. NAT makes this easier in one direction (from "behind the NAT" to outside) but this imposes a NAT behind a NAT type of thing - doable, but a pain as it doesn't allow the middle network to access behind the lower level NAT.

Hi Guys, Just one question, is it possible to have a Redhat box as a "router" between two networks (Disregard of privet or public) just by adding net.ipv4.ip_forward = 1 with our having to configure Iptables.

Hi Guys, Just one question, is it possible to have a Redhat box as a "router" between two networks (Disregard of privet or public) just by adding net.ipv4.ip_forward = 1 with our having to configure Iptables.

Thanks and Best Regards

I believe that is what it is used for. The only IP numbers not routed would be the non-routable ones.

I think this is how the Quality of Service functions are handled by iptables. By default the only thing governing the routing are the specified routes set via the "route" utility.

When I was working, this function was normally handled by the Cisco (and other vendors) routers rather than by a host. So most of my experience with it was by NAT for isolating a test machine from a network, where the test machine was being targeted for use on another network. This allowed me to test everything as if the machine was in its targeted environment, without actually being in the target environment. Installation was a "drop in" and plug-it-in - taking only seconds to accomplish. I have replaced entire Kerberos environments with such a drop in without anyone noticing I had replaced the KDC. (I found it much safer to update the OS and Kerberos that way than the usual way of updating the backup... not good to have a "test" backup server when/if the primary fails for some reason.)

Okay, so now that we've established what problem we're chasing, I'm going to say that the solution is definitively not as simple as setting one or two kernel parameters (like net.ipv4.ip_forward = 1). A quality solution that covers all of the bases and does not leave security problems or maintenance problems involves quite a number of iptables rules, as well as sundry other settings. As someone correctly pointed out, a router and a firewall are really just two names for the same thing in this context.

procfs should use a tool made for the purpose of developing and deploying the correct collection of iptables rules. This may be in the form of GUI-based firewall creator, or a canned package of iptables rules and configurations as one or more shell scripts. These systems have been developed by people with significant expertise and experience, and have been used and refined by a cast of millions over a period of time. Having said this, I have no personal experience with the style of router that is needed here. Most or at least many packages for building firewalls/routers are geared toward the home or small business scenario, where the objective is to attach a local LAN to a single internet connection.

I'm not sure of the implications of routing between two local private networks, but I'm sure that there is a package that provides for configuration of LAN-LAN routing. I will leave it to others to suggest something. Meanwhile, it would be very very helpful if the OP could describe fully and unambiguously, the organization of the networks involved, the network interfaces of the router host, and what connectivity is desired, as well as what connectivity is to be prohibited.

It would actually be easier to make the Linux system a bridge between two segments of the same private network... I'm not sure, but it may be possible to define the bridge to use the network 192.168.0.0 network - and thus pass both subnets to the other side. It isn't a good solution as you may as well just use one private network instead.

Private networks were set aside specifically for use in test/development environments, to ensure that that network traffic NOT get broadcast. I have seen the 10.x.x.x private network used for large clusters... Routing between two such clusters is done using public IP numbers assigned to the public interfacing nodes. And you don't get arbitrary node from cluster a to node on cluster b connections.

Hi Guys, I was able to fix the problem "the system was not routing across networks" it was my fault not checking routing in our main Internet router "Simply there was no return path" when I add the route to the gateway router, pointing how to reach our privet 11 range things stared working . Such a trivia thing, yet I failed to see . Now I need to setup the Iptabes and get the firewall going